R-Vision Threat Deception Platform (TDP) by R-Vision is a set of digital simulation technologies designed for detecting intruders in corporate networks, slowing their progress within the network, and preventing the escalation of attacks in the early stages. R-Vision TDP detects cybercriminals using traps and decoys, slowing their movement within the network by confusing them with false objects. This allows security specialists to stop the attack before it causes significant damage. Traps are placed on separate Trap Manager servers, while platform management and emulated infrastructure occur on the Control Center server, which collects and processes security events, interacts with external systems, and manages traps, decoys, and Trap Manager servers. For large organizations, the scaling task is easily solved by adding the necessary number of Trap Manager servers. R-Vision TDP allows for the automatic deployment of trap systems that emulate the organization's real IT assets and manage them from a single center. It allows the creation of various types of traps that replicate a wide range of systems in an organization's infrastructure, including Windows and Linux workstations/servers, emulation of SSH, SMB, FTP, RDP, HTTP(s), FTP services, industrial controllers (SCADA traps), and fake accounts in Active Directory. Bait generation and placement are automatically arranged on traps and real infrastructure nodes to attract the attention of attackers. The bait consists of information valuable to an attacker who has infiltrated the network, such as configuration files of popular administration utilities, data files, user accounts, saved credentials in browsers, SSH keys, and database connection credentials. R-Vision TDP collects events during interactions with emulated infrastructure objects, processes them, and sends alerts to cybersecurity specialists. The platform can also transmit events and necessary context to external systems like IRP/SOAR, SIEM, and TIP for response and attack prevention. For realistic traps and decoys, R-Vision TDP integrates with asset data from R-Vision SOAR or R-Vision SGRC. The platform detects interactions from both external and internal intruders with traps and alerts the cybersecurity specialist. Events can be sent to the R-Vision UEBA system for investigation, allowing automatic timeline construction that reflects interactions with traps, providing necessary context to the SOC analyst. Incidents can be forwarded to R-Vision SOAR to automate response using playbooks. Attributes and indicators of compromise collected by R-Vision TDP from the analysis of attacker actions can be automatically transmitted to the R-Vision TIP threat intelligence analysis platform. The R-Vision TIP platform will enrich this data, identify relationships with other available threat intelligence data, configure automatic monitoring in SIEM events, and export indicators of compromise to protection tools for blocking.
